Trojanized Enterprise Tools and Blockchain C2: AI Cybersecurity Threats in 2026

Attackers don't always need complex zero-day exploits when they can simply trick users into running fake installers. Since at least June 2025, a financially motivated Russian-speaking threat group tracked as UAT-11795 has been quietly compromising corporate endpoints across North America and Europe. They aren't going after obscure network devices. Instead, they're weaponizing software that employees use every single day—tools like Cisco WebEx, Zoom, MobaXterm, DBeaver Community Edition, and even the FACEIT gaming platform.

Trojanized Software and AI Cybersecurity Threats in 2026

This campaign highlights how ai cybersecurity threats 2026 continue to evolve toward opportunistic, volume-driven initial access. Telemetry from security research teams shows the heaviest concentration of targets in the United States, alongside confirmed infections in Germany, Romania, and Venezuela. Rather than zeroing in on a single industry, UAT-11795 casts a wide net. By trojanizing developer tools alongside collaboration platforms, the group catches systems administrators, software engineers, and general administrative staff in a single swoop.

The initial distribution relies heavily on the "ClickFix" delivery model. Attackers prompt users with social engineering lures that trick them into launching a malicious HTML Application (HTA) file via mshta.exe. That HTA file fetches a trojanized Nullsoft Scriptable Install System (NSIS) installer hosted on staging domains like zynaris[.]io. The user thinks they're updating their video conferencing client or database workbench. In reality, they've just opened the door to complete host compromise. Insights from our analysis on Securing Autonomous Agents: The New CISO Challenge emphasize how modern endpoint defenses struggle when malicious activity stems from user-sanctioned software setups. As reported by BleepingComputer, this opportunistic approach gives threat actors deep persistence before security teams realize an anomaly occurred.

Technical Breakdown of the Starland RAT Payload

Inside the trojanized installer, UAT-11795 hides a compiled Python package masquerading under an innocent filename like LICENSE.txt. When the NSIS installer runs, it executes this byte-compiled Python code directly in memory. This initial loader is responsible for establishing persistence on the target system by writing entries to the Windows Registry and creating scheduled tasks alongside Startup folder items.

Once persistent, the loader unpacks and executes the core backdoor: Starland RAT. Starland is a custom Python-based remote access trojan built specifically to survive in Windows environments while evading basic detection. Before starting its main routine, Starland performs anti-analysis checks to confirm it isn't executing inside a sandbox or security vendor lab. If the environment looks clean, it gathers extensive system telemetry:

• System Fingerprint: Hardware ID (HWID derived from the C: drive volume serial number), total RAM, CPU architecture, operating system build, local computer name, geographical region, public IP address, and active antivirus services.
• Credential Harvesting: Web browser login stores, cookies, auto-fill records, and stored web credentials across major platforms.
• Cryptocurrency Vaults: Local configuration files and private keys for over 40 desktop cryptocurrency wallets and browser extensions.
• Active Directory Reconnaissance: Domain hierarchy, local domain controllers, active user accounts, and specific victim domain privileges.

Starland RAT doesn't stop at passive data collection. It functions as an interactive command execution engine. Attackers can push direct Windows shell commands, capture desktop screenshots in real time, fetch and execute arbitrary binaries (such as .exe, .msi, .dll, or .zip packages), and inject both 32-bit and 64-bit shellcode directly into running processes.

According to threat intelligence from Cisco Talos, UAT-11795 uses Starland's shellcode injection capabilities to push secondary payloads based on target architecture. On 64-bit endpoints, the RAT injects CastleStealer—a .NET malware designed to exfiltrate Telegram sessions, Discord tokens, Steam accounts, and sensitive local files. On 32-bit systems, it deploys Remcos RAT to grant attackers full remote administration capabilities, including keylogging, microphone recording, and webcam streams.

The In-Memory WLDR Agent and Smart Contract C2

What makes UAT-11795 particularly dangerous isn't just their initial access method; it's their C2 architecture. Alongside Starland RAT, the group deploys a previously undocumented PowerShell C2 memory implant known as the WLDR agent.

The WLDR agent is engineered to operate entirely in memory without leaving artifacts on disk. It relies on a custom Runspace execution engine that processes commands and delivers secondary binaries directly inside PowerShell process memory. Network communications from the WLDR agent use strong encryption powered by PBKDF2-SHA256 key derivation. Every beacon sent back to the command server is bound to the target's unique hardware identifier (HWID), preventing threat analysts from replay-testing C2 endpoints without matching the original victim's hardware profile.

To maintain control over compromised hosts, UAT-11795 distributes their infrastructure across specific domain roles:

• Payload Staging: Domains such as eorthopaedics[.]com (a hijacked legitimate site) and sastoro[.]com serve PowerShell stage chains under /feed/ and /alpha/ paths. Raw shellcode is hosted on web-devtools[.]com under specific paths like /starlandfox and /x32remka.
• Primary C2: Starland RAT connects directly to domains like windowscreenrepairnearme[.]com and aipythondevs[.]com.
• Telegram Notification Bots: The actors configure dedicated Telegram bots (skuefq_bot and komandastuk_bot) and a private Telegram C2 channel named stuk komanda to process incoming victim registration alerts and wallet inventory dumps automatically.

If defensive teams block or sinkhole their primary C2 domain names, UAT-11795 relies on an unusual fallback mechanism: smart contract storage on the Polygon blockchain. Starland RAT contains logic to query a specific smart contract (0x6ae382ed2154cc84c6672e4e908cd2c69c1b35ba) using standard eth_call JSON-RPC requests over public endpoints. The smart contract responds with an XOR-encrypted string containing active fallback C2 domains. Because JSON-RPC requests to public Web3 nodes look like routine Web3 application traffic, standard perimeter firewalls almost never flag them. This level of C2 resilience mirrors broader shifts examined in our research on Cybersecurity Evolution: From Perimeter Defense to AI-Native Security.

Securing Enterprise Networks: Defenses and Best Practices

Defending against an adversary like UAT-11795 requires moving past basic file scanning. When attackers use trojanized versions of legitimate utilities, traditional antivirus tools that rely on static file signatures fall short. Recent industry telemetry from security researchers at IBM and defensive teams worldwide confirms that initial access via user-executed HTA files remains one of the highest-yield attack vectors in enterprise environments.

Securing your network against these threats requires a complete overhaul of workstation execution controls and application governance:

1. Block Script Hosts and HTA Execution: Disable mshta.exe execution for non-administrative users across all enterprise endpoints. There's almost no legitimate business reason for a standard user workstation to execute HTA files directly from a browser prompt.
2. Enforce Strict Application Control: Implement Software Restriction Policies (SRP) or Windows Defender Application Control (WDAC) to ensure users cannot run unverified installers downloaded from the web. All executable files should require valid digital signatures from verified enterprise vendors.
3. Monitor Memory-Based PowerShell Execution: Because the WLDR agent operates in memory, endpoint protection tools must monitor PowerShell for unmanaged runspace creation and encrypted network calls carrying HWID parameters. Deploying specialized agentic guardrails, such as those detailed in our Claw Patrol: A Security Firewall for Autonomous AI Agents overview, helps flag anomalous process behavior before data exfiltration occurs.
4. Audit Web3 and RPC Traffic: Block or alert on outgoing JSON-RPC requests directed to public Polygon infrastructure from standard corporate endpoints, especially when originated by non-browser binaries or script hosts.
5. Ditch Manual Workaround Guides: Training users not to paste command-line scripts found in pop-up windows is critical. If an employee relies on an online tutorial to troubleshoot a software glitch and gets prompted to run elevated commands, technical controls must prevent that execution regardless of user consent.

By locking down script execution engines and continuously inspecting memory operations, security teams can break the UAT-11795 attack chain long before the WLDR agent or Starland RAT can exfiltrate corporate credentials.